DF-5629 VERDICT

Status: reproduced (impact: leak) — fix validated

Guest: DragonFly 6.5-DEVELOPMENT x86_64 (X86_64_GENERIC), cc 8.3, kern.elf64.fallback_brand = -1. Executed as unprivileged user maxx (uid 1001); capture via script(1) pty (uprintf goes to the controlling terminal, subr_prf.c:146/tprintf:186).

How it was proven

1. Crafted ELF64, EI_OSABI = 0 (brands DragonFly per imgact_elf.c:569-573, brand wired at sys/cpu/x86_64/misc/elf_machdep.c:58-68), PT_INTERP payload = 1000 non-NUL bytes (p_filesz=1000 <= MAXPATHLEN passes imgact_elf.c:663-666).
2. extract_interpreter (imgact_elf.c:1817-1863) kmalloc(1000) — lands in the kmalloc-1024 zone; bytes [1000..1023] of the chunk are stale kernel heap; uprintf("ELF interpreter %s not found\n", interp) (imgact_elf.c:844) prints payload + stale bytes + whatever follows the chunk until a NUL.
3. Baseline (unpatched kernel #0, Thu Jul 2 06:02:54 UTC 2026): - 3/3 deterministic samples, 23 extra bytes each. - Leaked content is decodable kernel heap residue: run1: tmp/df5629/make_interp2, run2: /tmp/df5629, run3: tmp/df5629/m + /tmp/df5629 (see leak_sample.txt) - An ungroomed run additionally leaked ff ff (2 bytes of adjacent kernel heap) — real heap bytes, not our own payload. - Size matrix (8 runs/size): size=1000 → 8/8 runs leaked (184 bytes total); size=48 → 7/8; size=32 → 6/8; size=1024 → 0/8 (neighbor's first byte tends to be NUL); confirming the read walks past the requested allocation into allocator/neighbor memory.
4. The value leaks to the tty of the unprivileged user: local kernel heap info disclosure (stale M_TEMP contents: kernel paths and pointers of other subsystems; length is heap-layout dependent and can be extended by grooming — groom.c).

Fix validation (kernel #1, patched with fix.diff, built 23:30 UTC)

• make nativekernel + installkernel + reboot; uname -v confirms #1.
• Same PoC binary: direct exec → Exec format error (ENOEXEC); extract_interpreter now rejects payloads with no NUL inside p_filesz (imgact_elf.c:done label). tty transcript contains 0 "ELF interpreter" lines (was 1 + 23 heap bytes).
• No regression: normal dynamic binaries (ld-elf.so.2, NUL-terminated PT_INTERP) still exec (the whole system boots and runs).

Why this matters

Any unprivileged user can exec a file they own; no mount options, sysctls, or privileges involved. The leak length is bounded only by the distance to the next NUL byte in kernel heap after the kmalloc chunk — with grooming, multi-chunk disclosure is plausible (kernel pointers, file paths, other processes' data). Class: CWE-170/CWE-125-adjacent (termination + OOB read), kernleak bucket.

Root cause lines: sys/kern/imgact_elf.c:1817-1863 (no NUL-termination), consumer sys/kern/imgact_elf.c:844 (unbounded %s). Executed as: maxx (uid 1001), unprivileged.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.